Events Manager 5.8.1.1 – Stored XSS

Posted on

INFO Product: Events Manager Version: 5.8.1.1 Active installations: 100,000+ Product page: https://it.wordpress.org/plugins/events-manager/ CVE: 2018-9020 DESCRIPTION An unauthenticated user or a user without privileges, who can submit an event, can inject javascript code in the Google Maps miniature. The malicious code runs in the admin panel when a user with privileges opens the submitted event. The problem … Continue reading Events Manager 5.8.1.1 – Stored XSS

Utilizzare il Raspberry Pi 3 via Termux

Posted on

AGGIORNATO IN DATA 8/03/2018 In data 8/03/2018 ho modificato quasi completamente il post originale, perché ho deciso di impuntarmi e risolvere i miei problemi con Raspbian Stretch. La soluzione adottata in questa versione dell’articolo è senza dubbio migliore della precedente: è più facile, più veloce e ho utilizzato una distribuzione (Raspbian) adatta ad un uso … Continue reading Utilizzare il Raspberry Pi 3 via Termux

Bookly #1 WordPress Booking Plugin (Lite) 13.2 – Blind Stored XSS

Posted on

INFO Product: Bookly #1 WordPress Booking Plugin (Lite Version) Version: 13.2 Active installations: 10,000+ Product page: https://wordpress.org/plugins/bookly-responsive-appointment-booking-tool/ CVE: 2018-6891 DESCRIPTION An unauthenticated user can inject arbitrary persistent javascript code in the admin panel. PROOF OF CONCEPT Bookly Lite 13.2 and Bookly Pro 14.5 are affected, probably even earlier versions. I think the problem is that jQuery.ajax request is … Continue reading Bookly #1 WordPress Booking Plugin (Lite) 13.2 – Blind Stored XSS